Oracle E-Business Suite CVE-2026-62514

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a valid low-privileged EBS account with some access to the Oracle Process Manufacturing Regulatory Management (Internal Operations) component (CVSS PR:L). The target must be running an affected release in the 12.2.3-12.2.15 range with the OPM Regulatory Management module deployed and reachable. Limiting factors: authentication is needed (a low-privilege login, per PR:L - despite the 'Authentication Bypass' tag, which is not confirmed by the CVSS vector and should be verified with Oracle), the vulnerable component must be network-reachable rather than restricted to internal segments, and only Regulatory-Management-accessible data is at risk; there is no availability impact (A:N). No user interaction is required (UI:N).

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a genuinely serious, easily-exploitable network flaw that requires only low privileges and no user interaction, yielding full read and write access to component data with no availability impact. Oracle describes it as 'easily exploitable,' which aligns with AC:L. However, several strong signals are absent: there is no EPSS score in the input, no CWE, no CISA KEV listing, and no public POC, so real-world exploitation pressure cannot be quantified and appears low-to-unproven at this time. Note a conflict to verify with the vendor: the intelligence tag says 'Authentication Bypass,' which would normally imply PR:N (unauthenticated), yet the authoritative CVSS vector specifies PR:L (a valid low-privileged account is required) - treat the flaw as requiring authentication unless Oracle states otherwise. Overall this is a high-priority patch for organizations actually running OPM Regulatory Management, but the lack of KEV/POC/EPSS signals suggests it is not yet under active or widespread exploitation.

An attacker who holds or phishes any low-privileged Oracle EBS application account sends crafted HTTP requests to the OPM Regulatory Management functions and, exploiting the authorization weakness, reads and alters regulatory/compliance data outside their assigned entitlements. Because the flaw is network-exploitable with low attack complexity and no user interaction, the requests can be scripted once the endpoint and access pattern are known. No public exploit code is identified at time of analysis.